CVE-2007-1001MEDIUM
Description
Multiple integer overflows in the (1) createwbmp and (2) readwbmp functions in wbmp.c in the GD library (libgd) in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allow context-dependent attackers to execute arbitrary code via Wireless Bitmap (WBMP) images with large width or height values.
References
http://cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/wbmp.c?r1=1.2.4.1&r2=1.2.4.1.8.1
http://cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/wbmp.c?revision=1.2.4.1.8.1&view=markup
http://docs.info.apple.com/article.html?artnum=306172
http://ifsec.blogspot.com/2007/04/php-521-wbmp-file-handling-integer.html
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
http://rhn.redhat.com/errata/RHSA-2007-0155.html
http://secunia.com/advisories/24814
http://secunia.com/advisories/24909
http://secunia.com/advisories/24924
http://secunia.com/advisories/24945
http://secunia.com/advisories/24965
http://secunia.com/advisories/25056
http://secunia.com/advisories/25151
http://secunia.com/advisories/25445
http://secunia.com/advisories/26235
http://security.gentoo.org/glsa/glsa-200705-19.xml
http://us2.php.net/releases/4_4_7.php
http://us2.php.net/releases/5_2_2.php
http://www.mandriva.com/security/advisories?name=MDKSA-2007:087
http://www.mandriva.com/security/advisories?name=MDKSA-2007:088
http://www.mandriva.com/security/advisories?name=MDKSA-2007:089
http://www.mandriva.com/security/advisories?name=MDKSA-2007:090
http://www.novell.com/linux/security/advisories/2007_32_php.html
http://www.redhat.com/support/errata/RHSA-2007-0153.html
http://www.redhat.com/support/errata/RHSA-2007-0162.html
http://www.securityfocus.com/archive/1/464957/100/0/threaded
http://www.securityfocus.com/archive/1/466166/100/0/threaded
http://www.securityfocus.com/bid/23357
http://www.securityfocus.com/bid/25159
http://www.slackware.org/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.470053
http://www.vupen.com/english/advisories/2007/1269
http://www.vupen.com/english/advisories/2007/2732
https://exchange.xforce.ibmcloud.com/vulnerabilities/33453
https://issues.rpath.com/browse/RPL-1268
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10179
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:php:php:4.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0:beta1:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0:beta2:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0:beta3:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0:beta4:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0:beta_4_patch1:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0:rc1:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0:rc2:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.1:patch1:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.1:patch2:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.3:patch1:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.4:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.4:patch1:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.5:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.6:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.7:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.7:rc1:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.7:rc2:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.7:rc3:*:*:*:*:*:*
cpe:2.3:a:php:php:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.1.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.1.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.2:*:dev:*:*:*:*:*
cpe:2.3:a:php:php:4.2.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.2.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.2.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.2.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.4:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.5:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.6:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.7:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.8:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.9:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.10:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.11:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.4.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.4.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.4.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.4.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.4.4:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.4.5:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.4.6:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0:rc1:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0:rc2:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0:rc3:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.0:beta3:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.0:beta4:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.0:rc3:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.4:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.5:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.1.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.1.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.1.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.1.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.1.4:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.1.5:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.1.6:*:*:*:*:*:*:*
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 78215 | F5 Networks BIG-IP : Multiple PHP vulnerabilities (SOL7859) | Nessus | F5 Networks Local Security Checks | high |
| 67471 | Oracle Linux 3 / 4 : php (ELSA-2007-0155) | Nessus | Oracle Linux Local Security Checks | high |
| 17797 | PHP 5.x < 5.2.2 Multiple vulnerabilities | Nessus | CGI abuses | high |
| 37164 | Mandrake Linux Security Advisory : php (MDKSA-2007:090) | Nessus | Mandriva Local Security Checks | high |
| 29378 | SuSE 10 Security Update : PHP5 (ZYPP Patch Number 3290) | Nessus | SuSE Local Security Checks | high |
| 27150 | openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-3289) | Nessus | SuSE Local Security Checks | high |
| 25340 | GLSA-200705-19 : PHP: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | high |
| 25325 | RHEL 5 : php (RHSA-2007:0153) | Nessus | Red Hat Local Security Checks | high |
| 25207 | FreeBSD : php -- multiple vulnerabilities (f5e52bf5-fc77-11db-8163-000e0c2e438a) | Nessus | FreeBSD Local Security Checks | medium |
| 25174 | Slackware 10.2 / 11.0 / current : php (SSA:2007-127-01) | Nessus | Slackware Local Security Checks | medium |
| 25159 | PHP < 4.4.7 / 5.2.2 Multiple Vulnerabilities | Nessus | CGI abuses | high |
| 25113 | Mandrake Linux Security Advisory : php (MDKSA-2007:089) | Nessus | Mandriva Local Security Checks | high |
| 25095 | CentOS 5 : php (CESA-2007:0153) | Nessus | CentOS Local Security Checks | high |
| 25068 | RHEL 3 / 4 : php (RHSA-2007:0155) | Nessus | Red Hat Local Security Checks | high |
| 25043 | CentOS 3 / 4 : php (CESA-2007:0155) | Nessus | CentOS Local Security Checks | high |